Hacker News new | ask | show | jobs
by jlgaddis 3180 days ago
FWIW, requiring encryption on a public MX host is a violation of RFC, if memory serves.
2 comments

RFC2487 says:

A publicly-referenced SMTP server MUST NOT require use of the STARTTLS extension in order to deliver mail locally. This rule prevents the STARTTLS extension from damaging the interoperability of the Internet's SMTP infrastructure. A publicly-referenced SMTP server is an SMTP server which runs on port 25 of an Internet host listed in the MX record (or A record if an MX record is not present) for the domain name on the right hand side of an Internet mail address.

---

However, this RFC is now 18 years old.

https://datatracker.ietf.org/wg/uta/documents/

shows that https://datatracker.ietf.org/doc/draft-ietf-uta-email-deep/ is now in Last Call -- the title is "Cleartext Considered Obsolete: Use of TLS for Email Submission and Access" and coming up soon we have https://datatracker.ietf.org/doc/draft-ietf-uta-mta-sts/ with this abstract:

SMTP Mail Transfer Agent Strict Transport Security (MTA-STS) is a mechanism enabling mail service providers to declare their ability to receive Transport Layer Security (TLS) secure SMTP connections, and to specify whether sending SMTP servers should refuse to deliver to MX hosts that do not offer TLS with a trusted server certificate

Having written multiple RFCs, violating the RFC is not always a bad thing. Some of the MUSTs are a result of the committee process, and follow the lowest common denominator.

If the recommendations don't make sense, don't follow them.

> If the recommendations don't make sense, don't follow them.

In general, I would tend to agree -- so long as you aren't "hurting" (affecting) anyone else.

OTOH:

  $ tail -n 4 ~/.signature

  "The total budget at all receivers for solving senders' problems is
  $0. If you want them to accept your mail and manage it the way you
  want, send it the way the spec says to."  --John Levine
I'm responsible for a bunch of mail servers and occasionally get reports that messages from some random sender to a mailbox on one of these servers is not being accepted. More often than not, it's because RFCs aren't being followed (WRT SMTP, I'm not very liberal in what I accept). Of course, they will demand that I "fix" my "broken" servers that are refusing to accept their messages. Sometimes the non-compliance is intentional but usually it is simply out of ignorance (especially true when the remote host runs Microsoft Exchange); I try to point them at the RFCs, explain why their mail is being refused, and what they can change so that the mail will be accepted.